115
Chapter 12
Working with Log Files
Collating event log files
You can use Traffic Server’s log file collation feature to keep all logged information in one place. This allows
you to analyze Traffic Server as a whole rather than as individual nodes and to use a large disk that may only
be located on one of the nodes in a cluster.
Traffic Server collates log files by using one or more nodes as log collation servers and all remaining nodes
as log collation clients. When a Traffic Server node generates a buffer of event log entries, it determines
whether it is the collation server or a collation client. The collation server node simply writes all log buffers
to its local disk, just as it would if log collation were not enabled.
The collation client nodes prepare their log buffers for transfer across the network and send the buffers to the
log collation server. When the log collation server receives a log buffer from a client, it writes it to its own log
file as if it were generated locally. See Figure 12-1.
Figure 12-1. Log collation
If log clients cannot contact their log collation server, they write their log buffers to their local disks, into
orphan log files. Orphan log files require manual collation. See Figure 12-2.
Figure 12-2. Orphan log files hold data that cannot be written to the log server
Log collation servers may be stand-alone or they may be part of a node running Traffic Server.
NOTE
Log collation may have an impact on network performance. Because all nodes are
forwarding their log data buffers to the single collation server, a bottleneck may occur in
the network, where the amount of data being sent to a single node in the network
exceeds the node’s ability to process it quickly.
Node 1
Log
Node 2
Node 3
Node 4
Node 5
(log collation server)
Master Log
Log
Log
Log
Log
Node 1
Node 2
Node 3
Node 4
Log Collation
Server
Log
Log
Log
Log
Orphan Log File
Orphan Log File
Orphan Log File
Orphan Log File
